Samantha: Hello, this is Samantha Shares.
This episode covers the O C Câs Semi-annual Risk
Perspective, Trends In Key Risks.
The following is an audio version of that section of the report.
This podcast is educational and is not legal advice.
We are sponsored by Credit Union Exam Solutions Incorporated, whose
team has over two hundred and Forty years of National Credit
Union Administration experience.
We assist our clients with N C U A so they save time and money.
If you are worried about a recent, upcoming or in process N C U A
examination, reach out to learn how they can assist at Mark Treichel DOT COM.
Also check out our other podcast called With Flying Colors where we provide tips
on how to achieve success with N C U A.
The office of the Comptroller of Currency â the O C C issues
a semi-annual Risk Perspective.
This past Decemberâs report has many key sections and todayâs podcast highlights
the section called Trends in Key Risks
And now the report.
A.
Credit Risk.
COMMERCIAL CREDIT THEMES.
Commercial credit risk remains moderate and increasing.
While recessionary pressures are easing, the consensus among
economists is that the U.S.
economy will experience slowing growth, which will affect vulnerable borrowers.
Inflation remains elevated, and many economists predict that interest
rates will remain higher for longer.
Wages remain a primary cost driver, and companies in the service industries are
the most affected by higher labor costs.
Operating margin deterioration is particularly evident in senior
living and health care facilities, which are experiencing both wage
inflation and staffing shortages.
Elevated interest rates also continue to have an adverse impact on some
companiesâ profit margins and cash flow.
The companies most affected are those with high leverage and marginal repayment
capacity, smaller and lower-rated firms with shorter debt maturities, firms with
a higher level of floating debt, and firms with limited financial flexibility.
An obligor on a maturing loan with a balloon payment will likely need
to demonstrate a higher repayment capacity at renewal or refinance due
to higher debt costs and, for CRE loans, lower property values could
also lead to the need for re-margining.
Renewed loans should be appropriately risk-rated.
The liberal use of extensions and renewals could mask credit weaknesses
and obscure a borrowerâs inability to meet reasonable repayment terms.
Generally, risk ratings are driven by the strength of the primary source
of repayment rather than collateral value or strength of guarantor.
The Federal Reserve has not ruled out additional federal funds rate
hikes if inflation remains elevated.
Manufacturing production and new order indexes are declining.
Further rate hikes would continue to increase the cost of business
investment and consumer goods, placing downward pressure on demand.
Demand-side shocks for industries and companies already under stress
from high input costs or higher interest rates create the potential
for a rapid and sustained decline in cash flow and profitability.
The sustained period of price increases will likely serve as a
drag on revenues for a wide range of industries, particularly growth-dependent
borrowers and industries that are dependent on consumer discretionary
spending, if consumers significantly curtail spending across the board.
Credit quality metrics for C R E in some markets show signs of deterioration
as persistent headwinds threaten asset quality and loan performance.
C R E concentrations increased steadily over the past 18 months, and refinance
risk is heightened due to higher debt costs and increases in operating expenses.
Expenses, including utilities, property insurance, and taxes, are rising.
Increasing debt costs are driven by higher interest rates and lower valuations.
In June 2023, the O C C, the Federal Reserve, Federal Deposit Insurance
Corporation, and National Credit Union Administration published the âPolicy
Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts.â
The final interagency policy statement updates and builds on existing interagency
guidance on C R E loan workouts calling for banks to work prudently and
constructively with creditworthy borrowers during times of financial stress.
Risk in the office market remains high and is expanding
beyond urban business districts.
Although risk remains highest in urban core markets, vacancy rates
are rising for suburban submarkets.
Data suggest that the office sector is experiencing significant structural
shifts that could take several years to fully materialize as new remote
work practices normalize and office loans made before 20 20 mature.
Leases reflect smaller footprints for businesses as tenants seek
less square footage per employee.
There is some resiliency in
5-star and newer buildings, but these leases often include concessions and,
because of low demand, could negatively affect less well-situated properties.
Retail and other small business real estate in urban business districts
that are reliant on office worker foot traffic have higher and rising vacancy
rates than suburban submarket peers.
Risk in the multifamily market is increasing, with higher vacancy
levels due to a combination of new inventory and slowing demand.
Mortgage delinquencies for multifamily properties remain
low but are starting to increase.
Multifamily real estate risk varies by market, property type, and other factors.
Senior housing continues to struggle as health care worker shortages
exacerbate real estate risk factors.
Some parts of the United States, such as Phoenix and Salt Lake City, are
experiencing an overbuild in luxury properties, which leads to further
devaluation for older properties.
Other C R E markets remain sound but show signs of softening.
The industrial market, which has been the best performing C R E segment, is also
starting to exhibit some signs of slowing.
Overall industrial vacancy rates remain low, and it is uncertain whether the
market is reaching an inflection point or reverting to a normalized level.
Just as with other C R E property types, however, rising interest
rates will have a negative impact on cash flows and valuations and will
increase project financing costs.
While some retail property types have stabilized, regional
malls continue to struggle.
A heightened risk environment could strain the resources of credit risk
review and loan workout functions.
Retirements and other attrition, coupled with an extended benign
credit period, have decreased the number of bankers with problem loan
identification and mitigation experience.
Credit risk review functions may need to adjust sampling methodologies
to capture higher risk industries or segments, borrowers who become
constrained under stress test scenarios, or borrowers who exhibited marginal
repayment capacity at origination or during stronger economic conditions.
Workout functions could experience quickly increasing workloads that
warrant additional experienced staff.
Regardless of whether problem loans are part of a formal loan workout, accurate
and timely risk ratings are a key factor in successful credit risk management and
are critical for problem loan mitigation.
RETAIL CREDIT THEMES.
Retail credit performance remains satisfactory and has largely
normalized across all asset classes.
Lagging asset quality indicators have largely returned to
pre-pandemic levels and remain in line with long-term averages.
Portfolio growth moderated, with banks reported to have tightened underwriting
standards earlier in 2023 in response to uncertain economic forecasts.
Credit risk, including rising credit card and auto delinquencies, is
moderate and remains manageable.
Effective risk management practices, including stronger residential real
estate underwriting since the Great Recession and the low rate refinancings
done during the pandemic, will support homeownersâ repayment ability
and better position banks to manage through current economic challenges.
The strong labor market, rising wages, manageable debt levels, and elevated,
but declining, cash reserves enabled U.S.
consumers to withstand costs associated with the level of
inflation and rising interest rates.
Credit card and auto delinquencies, however, increased in most banks
in 20 23 and are increasing.
More material credit deterioration is evident in banks with higher risk
appetites and more nonprime strategies.
Retail net charge-offs, primarily driven by credit cards, have increased
steadily each quarter for the past year.
The most vulnerable segments of households continue to be those in
lower income brackets, on a fixed income, or more highly leveraged.
Higher interest rates on new originations and upward adjustments
on variable rate debt, along with the potential for declining asset
values, could place additional pressure on certain consumer and mortgage
borrower segments and loan vintages.
The resumption of federal student loan payments in October 20 23 and the
discontinuation of other government support programs pose uncertainty
regarding the potential impacts on some borrowersâ ability to pay.
The new Saving on Valuable Education (SAVE) program is anticipated to reduce
student loan payment shock by limiting payments to 5 percent of discretionary
income, increasing the amount of
income considered non-discretionary, and accelerating loan forgiveness.
Banks should evaluate the risk that consumersâ student loans
payment resumption may impact repayment of their other bank loans.
Additional considerations include the risk inherent in new loan
applications where missed student loan payments will not be reported
to the credit-reporting companies as delinquencies, and borrowers will not be
considered in default for the next year.
Residential real estate loan portfolios demonstrate satisfactory performance.
Consumer home loans reflect sound underwriting; and overall portfolio risk
metrics reflect satisfactory support from the level of homeowner equity.
Stress testing vulnerable vintages, segments, and geographies, on variables
such as unemployment, declining collateral values, and inflation impacts
on disposable income, is an effective
tool to identify weaker portfolio segments.
If identified, weaker segments warrant monitoring, incremental adjustments
to underwriting, and an emphasis on safe and sound principles in the
execution of loss mitigation programs to provide prudent, affordable, and
sustainable borrower payment assistance.
Borrower payment assistance programs for retail loan products take many forms.
Effective loss mitigation programs accurately address financial hardship
and underwrite the loan to the borrowerâs willingness and ability to pay the debt.
Prudent programs verify the borrowerâs sources of income, total debt, and
contractual payments, which support affordability and should result in
sustainability of the borrowerâs ability to repay their debt.
Loss mitigation programs based on unverified information and lacking
sufficient repayment analysis are inappropriate, and reliance on
extended amortization, extensions, and deferral of unpaid amounts
reflect a borrowerâs lack of repayment capacity and may not be in the best
interest of the borrower or the bank.
Imprudent loss mitigation programs can result in less effective
risk oversight and reporting.
Bank management should remain focused on accurate and timely risk
identification utilizing delinquency reporting, risk rating, loss
recognition, and financial reporting.
Market Risk.
The speed and magnitude of rising rates have materially influenced depositor
behavior and rate sensitivity in direction and magnitude inconsistent
with historic observations.
Banks are facing significant deposit competition from higher-yielding
choices as well as reduced broader market liquidity, which may
further pressure banksâ deposit retention and growth strategies.
Deposit competition has pushed rates higher and resulted in
increasing usage of higher cost CDs, brokered deposits, and borrowings.
Banksâ NIM could be further pressured from continued market liquidity contraction,
high and steady or increasing short-term rates, and a continued increasing trend
in deposit rates and funding costs.
Deposits as a percentage of assets in O C C-supervised institutions stabilized
at 79 percent through the third quarter of 2023 after trending down from a
peak of 82 percent at year-end 2021.
This stabilization was supported by increased brokered deposit
and wholesale funding usage.
Between year-end 2022 and September 30, 2023, borrowings in O C
C-supervised institutions increased 172 billion dollars (29 percent)
and brokered deposits increased 258 billion dollars (55 percent).
Rising deposit rates and increased reliance on
wholesale funding significantly increased funding costs through
the third quarter of 2023.
Banks with assets under 1 billion dollarshad a 91 basis point (131
percent) increase in funding costs while banks with assets over
1 billion dollars saw a 112 basis point (100 percent) increase.
Increased funding costs observed in 2023 compressed NIMs in smaller institutions,
despite rising asset yields, after significant NIM expansion in 2022.
The median NIM (quarterly annualized) in banks with assets between 10
billion dollars and 50 billion dollars declined 35 basis points to 3 point
14 percent, while banks with assets less than 10 billion dollars saw a
reduction of 22 basis points to 3.
point 0 percent.
Banks with assets greater than 50 billion dollars actually had a modest
improvement of 6 basis points in the third quarter, bringing median NIM to 3.10
percent and nearly back to the 3 point 12 percent observed at year-end 2022.
Stress testing and sensitivity analyses of deposit assumptions remain critical
given recent trends in deposit movement and rates as well as uncertainty regarding
depositor behavior moving forward.
Banks may experience continued pressure to raise deposit rates
contemporaneously and at higher levels than forecasted relative to market rate
changes to grow or retain deposits.
These factors may continue to compress margins, elevate risk to earnings, and
present new challenges for banks to model and project deposit rates and
balances in both interest rate and liquidity risk stress testing scenarios.
Inaccurate deposit assumptions will render model results unreliable and
may mask banksâ true interest rate risk and liquidity risk profiles.
Unreliable model projections and stresses may result in higher-than-forecast
funding costs, potentially unexpected liquidity shortfalls, and
imprecision in balance sheet hedging.
Sound liquidity risk management, including processes that ensure sufficient
committed capacity to meet contingent liquidity needs, remains critical.
Asset liquidity stabilized in 2023 and has been buoyed by increased
wholesale funding reliance.
Unrealized losses in OCC-supervised institutionsâ investment portfolios
were negatively impacted by continued increases in the 10-year U.S.
Treasury rates and remain a concern.
The current elevated levels of bank investment portfolio depreciation
could exacerbate risk exposure, particularly if security sales are
required to meet funding outflows.
Unrealized losses (as a percentage of amortized cost) in O C C-supervised
institutionsâ available for sale (AFS) portfolios increased in the
third quarter of 2023 and remain elevated at 8 percent, while unrealized
losses in held-to-maturity (HTM) portfolios increased to 16 percent.
Unrealized investment portfolio losses highlight the importance of
operational readiness to monetize securities in a timely manner in
case liquidity needs arise, to avoid recognizing unrealized losses.
Examples include repo lines, Federal Home Loan Bank (FHLB) capacity, and
access to Federal Reserve facilities.
Regular testing and capacity assessments will help ensure these
sources remain accessible.
This is particularly important for banks with large HTM holdings, as sale of
these securities can taint the portfolio and lead to recognition of losses.
Operational Risks: CYBERSECURITY
Operational risk continues to be elevated as cyberattacks evolve and become more
sophisticated and pervasive to the U.S.
economy.
Continuing cyberattacks and current geopolitical tensions highlight the
importance of heightened threat monitoring and safeguarding against disruptive
attacks targeting the financial sector.
Over the past year, there has been an observed increase in distributed
denial of service (DDoS) attacks against the financial sector.
Some of the increase may be attributed to politically motivated attacks
while others are financially driven, coupled with extortion demands.
Ransomware actors continue to affect the sector by targeting
banks and their third parties.
These attacks have the potential to affect banks and market operations by
rendering critical data inaccessible as well as by threatening the confidentiality
of customer data through data leaks.
Single cyber campaigns have demonstrated the ability to
compromise hundreds of organizations and affect a significant number
of consumers.
Threat actors continue to leverage phishing emails and texts targeting
employees and compromised credentials to gain access to networks
through remote access solutions.
Such unauthorized access would enable threat actors to conduct ransomware
and other extortion campaigns that can affect bank customers.
Malicious actors have also continued to use DDoS attacks
to target the financial sector.
Threat actors continue to exploit publicly known software vulnerabilities
and weak authentication controls at targeted organizations, including
banks and financial service providers.
To mitigate against cyber risks, it is important for banks to adopt heightened
threat and vulnerability monitoring processes and implement effective
security measures, including the use of multifactor authentication (M F A),
hardening of systems configurations, and timely patch management.
The OCC continues to see cybersecurity incidents that
exploit weak or poorly configured authentication controls and practices.
Recent attacks suggest that banks using single-factor authentication or relying on
weak security methods may face increased risk of unauthorized access to information
systems, potential operational disruption, data compromise, or financial loss.
The O C C encourages banks to conduct thorough risk assessments that
include authentication practices.
When consistently implemented, properly configured, and combined with other
layered security controls, M F A can provide an enhanced level of protection
and help prevent attacks on bank systems.
INNOVATION AND ADOPTION OF NEW PRODUCTS AND SERVICES
Banks continue to leverage new technology and innovative products and services
to further their digitalization efforts and to meet evolving
customer demand and expectations.
Examples of innovations include faster and real-time payment products,
increased use of mobile and digital technologies to deliver financial
services, application programming interfaces, data aggregation services,
AI, and contactless payment devices.
While these products and services and their underlying technologies
can offer many benefits to banks and their customers, they also contribute
to a complex operating environment along with increasing compliance,
reputational, strategic, and other risks.
It is important to assess how technology can be leveraged to fuel
rapid deposit outflows and how the use of social media and other digital
channels may accelerate communications.
Banks are also reminded to implement appropriate due diligence, change
management, and risk management processes when considering changes to products,
services, and operating environments.
Banks have approached AI adoption cautiously, with
a wide range of use cases.
The use of AI has the potential to reduce costs and increase efficiencies;
improve products, services, and performance; strengthen risk management;
and expand access to credit and other banking products and services.
AI systems may, however, present particular challenges related
to bias and discrimination.
For example, these systems may perpetuate or exacerbate the results
of historical discrimination if they are improperly trained or used
with data sets that reflect biases or past discrimination practices.
Use of generative AI is becoming more accessible with the
introduction of commercially available large language models.
Like with all new or expanded products, services, and relationships,
appropriate risk management processes, including due diligence
and change management, are needed.
Banks and service providers continue to face challenges with maintaining legacy
technology architectures while responding to increasing digitalization demands.
It is important for banks to maintain appropriate operational resilience for
on-premises and critical third-party technology architecture, commensurate
with the size and complexity of products, services, and operations being supported.
An effective operational resilience strategy can enhance a bankâs ability
to mitigate disruption from all hazards, including cyber threats, and other
technology and operational outages.
Sound risk management practices can help safeguard against fraud, financial
crimes, and operational errors.
While traditional payment channels, such as checks and wire transfers,
continue to be targeted, increasing digitalization of products and services
can also heighten risk of fraud and error, including fraud targeting P2P
and other faster payment platforms.
While P2P payment platforms can provide enhanced capabilities and
convenience to consumers for managing payments, the faster and streamlined
payment capabilities and the irreversible and irrevocable nature
of these payments have also been used to perpetuate consumer fraud.
Banks can aid customers by strengthening controls, educating customers on
potential scams, and enhancing internal fraud monitoring capabilities.
Examiners will continue to assess how banks are managing these and other
risks related to changes in operating environments driven by these innovations.
The O C C continues to approach crypto-asset products, services, and
activities cautiously for a variety of reasons, including high volatility,
high-risk lending, excessive leverage, interconnectedness, concentration
within the crypto industry, and lack of comprehensive regulation.
Banks are reminded to follow the process outlined in O C C Interpretative Letter
1179 before engaging in permissible crypto-asset-related activities.
THIRD-PARTY RISK MANAGEMENT AND OTHER OPERATIONAL RISKS
Digitalization and technological innovation continue to advance the trend
of banks outsourcing technology operations and banks entering partnerships or other
arrangements with third parties, including fintech firms, to deliver innovative
financial products and services.
For example, increasing adoption of cloud services in the financial
sector, as noted in a recent U.S.
Department of the Treasury report, is allowing banks to gain efficiencies, but
also can present risk if not implemented properly.The complexity of bank-fintech
partnerships is also increasing as the volume of new entrants within the
fintech ecosystem continues to grow.
Effective management and oversight are important for third-party relationships.
Third- party risk management processes should be commensurate with the
size, complexity, and risk profile of the bank and with the nature
of the third-party relationship.
It is also important for banks to engage in more rigorous oversight of
third-party relationships that support higher-risk and critical activities.
In addition, it is important for banks to maintain talent management
strategies to ensure sufficient resources and subject matter expertise
to implement critical controls.
Given demand for staff with specialized experience and technical expertise,
it may sometimes be necessary for banks to engage with a third party.
Compliance Risk: BANK SECRECY ACT/ANTI-MONEY LAUNDERING AND
OFFICE OF FOREIGN ASSETS CONTROL
COMPLIANCE RISKS
Banks continue to adopt or consider fintech relationships related to product
and service offerings, and it is import that they effectively manage the resulting
operational and compliance risks, including third-party risk management.
It is important that banks understand the benefits and risks associated
with each third-party relationship, with particular focus on relationships
that involve higher-risk or critical activities, and that they enter into
effective contracts addressing the potential for default and termination.
It is also important for banks to identify potentially nested
relationships where a fintech firm may be providing services to other fintech
firms without appropriate controls.
As the range of payment methods and their accessibility continue to expand
and evolve, for example with the launch of instant payments via FedNow, it
is important that banks continuously evaluate their BSA/AML risks and
corresponding controls to keep pace with new or changing risk profiles.
While banks continue to expand their digital and electronic products, services,
and capabilities, they should be aware of related risks, including a recent
alert issued by the Financial Crimes Enforcement Network (FinCEN) highlighting
a prominent virtual currency investment scam known as âpig butchering.â Banks
also should remain vigilant against traditional financial crime risks.
There have been significant increases in fraud, as highlighted in both
a FinCEN alert on the nationwide surge in mail theft-related check
fraud schemes, and a FinCEN analysis identifying threat patterns and
trends related to business email compromise in the real estate sector.
FinCEN also has noted increases in payroll tax evasion and workerâs compensation
fraud in the construction sector.
Suspicious activity report (SAR) data trends reflect significant increases
in SAR filings related to fraud.
Effective processes to prevent, identify, and file SARs in a timely
manner, including fraudulent activity, remain important to protect financial
institutions, consumers, and the financial system, as indicated
by the fact that fraud is one of FinCENâs National AML/CFT Priorities.
Banksâ responsibilities under the current Customer Due Diligence and
Beneficial Ownership Rule and other existing BSA requirements remain
unchanged, pending the issuance of changes to those regulatory requirements
as required by the AML Act of 2020.
CONSUMER COMPLIANCE AND COMMUNITY
REINVESTMENT ACT/FAIR LENDING (CRA/FL) RISKS
Banks continue to face heightened attention and focus on ensuring
equal access to credit, and fair and consistent treatment of consumers as
they adapt to changing customer needs and preferences related to product,
service, and delivery channel offerings.
Risks are compounded if changes are not delivered or implemented
in a fair or equitable manner.
Banksâ compliance risk management frameworks should be commensurate
with their existing risk profiles and capable of efficiently and effectively
supporting risk profile changes.
Additionally, as interest rates continue to rise, banks may experience
an increase in relief requests under the Servicemembers Civil
Relief Act on certain obligations or liabilities incurred before the
servicemember entered military service.
In particular, borrowers may seek relief for adjustable-rate credit
products such as credit cards and for eligible auto payments.
On October 24, 2023, the O C C, the Federal Reserve, and the F D I C issued
a final rule to strengthen and modernize regulations implementing the C R A.
The effective date of the rule is April 1, 2024, with key provisions of
the final rule going into effect on January 1, 2026, and January 1, 2027.
It is important for banks to plan for changes that become effective on
April 1, 2024, and to implement change management processes as appropriate
to address the potential impact of the rule on bank systems and resources.
Climate-Related Financial Risk
FINAL INTERAGENCY PRINCIPLES FOR CLIMATE-RELATED FINANCIAL
RISK MANAGEMENT FOR LARGE
FINANCIAL INSTITUTIONS
On October 24, 2023, the O C C, F D I C, and Federal Reserve issued final
Interagency Principles for Climate- Related Financial Risk Management
for Large Financial Institutions that provide a high-level framework
for the safe and sound management of exposures to climate-related
financial risk for financial institutions with total consolidated
assets over 100 billion dollars.
The principles support large financial institutionsâ efforts to focus on key
aspects of climate-related financial risk management, providing a high-level
framework for climate- related financial risk management consistent with the
agenciesâ existing rules and guidance.
OBSERVATIONS OF LARGE BANKSâ MANAGEMENT OF CLIMATE-RELATED FINANCIAL RISK
As noted in our Spring 2023 Semiannual Risk Perspective, the O C C has been
conducting supervision activities at its largest banks (those with over 100
billion dollars in total assets) to understand the banksâ climate- related
financial risk management programs.
This work is well underway and will continue in 2024.
As we stated in the spring, the large banks have been making progress
to incorporate climate-related financial risks in their risk
management frameworks and policies.
At the same time, the large banks overall have significant additional work to
do to move those programs to maturity.
Observations to date include:
Efforts to incorporate climate-related financial risk in strategic planning
remain in the early stages of development.
Most of these banks are also still in the early stages of
integrating climate-related financial risk into their broader risk
appetites, and some have developed quantitative risk appetite metrics.
Banks are reporting on climate-related financial risk to senior management and
the board and indicated that reporting will become more detailed moving forward.
Banks continue to face challenges and limitations on obtaining granular
data for their climate-related financial risk analysis.
Banks have generally developed or are planning to implement climate-related
credit risk assessments to evaluate borrowersâ and clientsâ exposures
to high-risk sectors and industries.
Banks are in the very early stages of understanding the impacts of
climate change and ways to mitigate climate-related financial risk on low- and
moderate-income communities they serve.
Bank management teams generally have focused their initial work on
the physical risks (e.g., flooding) of residential real estate.
This concludes the O C Câs Risk Perspective Report Section 4.
If your Credit union could use assistance with your exam, reach out to Mark Treichel
on LinkedIn, or at mark Treichel dot com.
This is Samantha Shares and we Thank you for listening.